Recent critical remote code execution flaws in PHP, disclosed and patched on October 21, 2026, have driven the near-even odds on another such issue emerging before year-end. The php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), rated 9.2 CVSS and affecting versions back to PHP 5, enable unauthenticated attacks via memory-safety issues in the request lifecycle; they were found partly through AI-assisted audits and saw pre-patch exploitation attempts. A third related flaw remains unpatched, while fresh reports of bypasses and working exploits against updated versions have surfaced in the past week. Traders weigh PHP’s rapid coordinated response and government alerts urging immediate upgrades against the language’s vast legacy footprint, PHP 8.2’s December 31 end-of-life, and accelerating discovery rates that could surface further issues before December.